@rogatio/cli 6.4.1 → 6.5.0

package/dist/node/index.js

@@ -6,6 +6,7 @@ import { basename as basename3, dirname as dirname8, resolve as resolve8 } from
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // packages/runtime/dist/node/index.js
+import { isIP } from "node:net";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 
@@ -1979,6 +1980,42 @@ function sourceMatches(source, url) {
     return false;
   }
 }
+var PAC_STEER_MARKER = "steer:";
+function decodePacSteer(entry) {
+  if (!entry.startsWith(PAC_STEER_MARKER)) return null;
+  const value = entry.slice(PAC_STEER_MARKER.length);
+  let url;
+  try {
+    url = new URL(`${value}/`);
+  } catch {
+    return null;
+  }
+  if (url.username !== "" || url.password !== "" || url.search !== "") {
+    return null;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+  const scheme = url.protocol === "https:" ? "https" : "http";
+  const port = url.port === "" ? void 0 : Number(url.port);
+  if (port !== void 0 && (!Number.isInteger(port) || port < 1 || port > 65535)) {
+    return null;
+  }
+  const rebuilt = port === void 0 ? `${scheme}://${url.hostname}` : `${scheme}://${url.hostname}:${port}`;
+  if (rebuilt !== value || !isLiteralSteerHost(url.hostname)) return null;
+  return port === void 0 ? { scheme, host: url.hostname } : { scheme, host: url.hostname, port };
+}
+function isLiteralSteerHost(host) {
+  if (host.length === 0 || host.length > 253) return false;
+  if (host.startsWith(".") || host.endsWith(".") || host.includes("..")) {
+    return false;
+  }
+  const labels = host.split(".");
+  for (const label2 of labels) {
+    if (label2.length === 0 || label2.length > 63) return false;
+    if (!/^[A-Za-z0-9-]+$/.test(label2)) return false;
+    if (label2.startsWith("-") || label2.endsWith("-")) return false;
+  }
+  return true;
+}
 function sameOrigin(a, b) {
   try {
     return new URL(a).origin === new URL(b).origin;
@@ -1998,6 +2035,9 @@ import {
 } from "node:http";
 import { connect } from "node:net";
 import { Worker } from "node:worker_threads";
+import { lookup as dnsLookup } from "node:dns/promises";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { readFile as readFile2, realpath as realpath2, stat } from "node:fs/promises";
@@ -20701,6 +20741,131 @@ var require_x509_cjs = __commonJS({
     exports.idX448 = idX448;
   }
 });
+function parseIPv4(value) {
+  const parts = value.split(".");
+  if (parts.length !== 4) return null;
+  const numbers = parts.map((part) => {
+    if (!/^(?:0|[1-9]\d*)$/.test(part)) return -1;
+    const number = Number(part);
+    return Number.isInteger(number) && number >= 0 && number <= 255 ? number : -1;
+  });
+  return numbers.some((number) => number < 0) ? null : [numbers[0], numbers[1], numbers[2], numbers[3]];
+}
+function parseIPv6(value) {
+  if (value.includes("%")) return null;
+  const halves = value.split("::");
+  if (halves.length > 2) return null;
+  const left = halves[0] === "" ? [] : halves[0]?.split(":") ?? [];
+  const right = halves.length === 2 && halves[1] !== "" ? halves[1]?.split(":") ?? [] : [];
+  const parts = [...left, ...right];
+  const words = [];
+  for (const part of parts) {
+    if (part.includes(".")) {
+      const ipv4 = parseIPv4(part);
+      if (ipv4 === null) return null;
+      words.push(ipv4[0] << 8 | ipv4[1], ipv4[2] << 8 | ipv4[3]);
+      continue;
+    }
+    if (!/^[0-9a-fA-F]{1,4}$/.test(part)) return null;
+    words.push(Number.parseInt(part, 16));
+  }
+  if (halves.length === 1) return words.length === 8 ? words : null;
+  if (words.length >= 8) return null;
+  return [
+    ...words.slice(0, left.length),
+    ...new Array(8 - words.length).fill(0),
+    ...words.slice(left.length)
+  ];
+}
+function ipv4Number(value) {
+  return ((value[0] * 256 + value[1]) * 256 + value[2]) * 256 + value[3] >>> 0;
+}
+function inIPv4Range(value, start, end) {
+  return value >= start && value <= end;
+}
+function prefixMatches(value, prefix, bits) {
+  let remaining = bits;
+  for (let index = 0; remaining > 0; index += 1) {
+    const compareBits = Math.min(remaining, 16);
+    const mask = compareBits === 16 ? 65535 : 65535 << 16 - compareBits & 65535;
+    if (((value[index] ?? 0) & mask) !== ((prefix[index] ?? 0) & mask))
+      return false;
+    remaining -= compareBits;
+  }
+  return true;
+}
+function mappedIPv4(value) {
+  if (value.slice(0, 5).some((word) => word !== 0) || value[5] !== 65535)
+    return null;
+  return [
+    (value[6] ?? 0) >> 8,
+    (value[6] ?? 0) & 255,
+    (value[7] ?? 0) >> 8,
+    (value[7] ?? 0) & 255
+  ];
+}
+function classifyIPv4(value) {
+  const number = ipv4Number(value);
+  if (inIPv4Range(number, 0, 16777215)) return "unspecified";
+  if (inIPv4Range(number, 167772160, 184549375) || inIPv4Range(number, 2886729728, 2887778303) || inIPv4Range(number, 3232235520, 3232301055))
+    return "private";
+  if (inIPv4Range(number, 2130706432, 2147483647)) return "loopback";
+  if (inIPv4Range(number, 2851995648, 2852061183)) return "link-local";
+  if (inIPv4Range(number, 1681915904, 1686110207)) return "carrier-grade";
+  if (inIPv4Range(number, 3221225472, 3221225727) || inIPv4Range(number, 3221225984, 3221226239) || inIPv4Range(number, 3227017984, 3227018239))
+    return "reserved";
+  if (inIPv4Range(number, 3323068416, 3323199487)) return "benchmarking";
+  if (inIPv4Range(number, 3325256704, 3325256959) || inIPv4Range(number, 3405803776, 3405804031))
+    return "documentation";
+  if (inIPv4Range(number, 3758096384, 4294967295)) return "multicast";
+  return "public";
+}
+function classifyIPv6(value) {
+  const mapped = mappedIPv4(value);
+  if (mapped !== null) {
+    return classifyIPv4(mapped);
+  }
+  if (value.every((word) => word === 0)) return "unspecified";
+  if (value.slice(0, 7).every((word) => word === 0) && value[7] === 1)
+    return "loopback";
+  if (prefixMatches(value, [64512], 7)) return "private";
+  if (prefixMatches(value, [65152], 10)) return "link-local";
+  if (prefixMatches(value, [65280], 8)) return "multicast";
+  if (prefixMatches(value, [8193, 3512], 32)) return "documentation";
+  if (prefixMatches(value, [8193, 0], 32)) return "reserved";
+  if (prefixMatches(value, [8193, 2, 0], 48)) return "benchmarking";
+  if (prefixMatches(value, [8193, 16], 28)) return "reserved";
+  if (prefixMatches(value, [100, 65435, 0, 0, 0, 0], 96))
+    return "reserved";
+  if (prefixMatches(value, [256], 8)) return "reserved";
+  return "public";
+}
+function classifyAddress(value) {
+  if (typeof value !== "string") return "invalid";
+  const family = isIP(value);
+  if (family === 4) {
+    const parsed = parseIPv4(value);
+    return parsed === null ? "invalid" : classifyIPv4(parsed);
+  }
+  if (family === 6) {
+    const parsed = parseIPv6(value);
+    return parsed === null ? "invalid" : classifyIPv6(parsed);
+  }
+  return "invalid";
+}
+function validateResolvedAddresses(addresses, maxAddresses) {
+  if (addresses.length === 0 || addresses.length > maxAddresses) return null;
+  const checked = [];
+  for (const address of addresses) {
+    if (address.family !== 4 && address.family !== 6 || classifyAddress(address.address) !== "public")
+      return null;
+    checked.push({ address: address.address, family: address.family });
+  }
+  checked.sort(
+    (left, right) => left.family - right.family || (left.address < right.address ? -1 : left.address > right.address ? 1 : 0)
+  );
+  return checked;
+}
 var MAX_RETRIES = 2;
 var RETRY_DELAY_BASE = 1e3;
 var COMPLETE_TIMEOUT = 6e4;
@@ -22084,11 +22249,183 @@ async function rewriteRequestBody(input, action, captureContext) {
     }
   };
 }
+var defaultResolver = {
+  async lookup(hostname, signal) {
+    if (signal?.aborted) throw new Error("aborted");
+    const addresses = await dnsLookup(hostname, { all: true });
+    return addresses.map((address) => ({
+      address: address.address,
+      family: address.family
+    }));
+  }
+};
+function responseHeaders(response) {
+  const headers = [];
+  for (let index = 0; index < response.rawHeaders.length; index += 2) {
+    const name = response.rawHeaders[index];
+    const value = response.rawHeaders[index + 1];
+    if (name !== void 0 && value !== void 0)
+      headers.push([name.toLowerCase(), value]);
+  }
+  return headers;
+}
+var defaultTransport = {
+  request(options) {
+    return new Promise((resolve22, reject) => {
+      const lookup = (_hostname, _options, callback) => {
+        callback(null, options.address, options.address.includes(":") ? 6 : 4);
+      };
+      const requestOptions = {
+        hostname: options.hostname,
+        port: options.port,
+        path: options.path,
+        method: options.method,
+        headers: options.headers,
+        agent: false,
+        lookup,
+        signal: options.signal,
+        setHost: false,
+        autoSelectFamily: false
+      };
+      const request = options.protocol === "https:" ? httpsRequest(
+        { ...requestOptions, servername: options.servername },
+        (response) => {
+          resolve22({
+            status: response.statusCode ?? 0,
+            headers: responseHeaders(response),
+            body: response
+          });
+        }
+      ) : httpRequest(requestOptions, (response) => {
+        resolve22({
+          status: response.statusCode ?? 0,
+          headers: responseHeaders(response),
+          body: response
+        });
+      });
+      request.once("error", reject);
+      request.end();
+    });
+  }
+};
+function headerValue(headers, name) {
+  return headers.find(([headerName]) => headerName.toLowerCase() === name)?.[1];
+}
+function responseHeaderBytes(headers) {
+  let bytes = 0;
+  for (const [name, value] of headers)
+    bytes += Buffer.byteLength(name) + Buffer.byteLength(value) + 4;
+  return bytes;
+}
+function combineSignals(signal, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const abort = () => controller.abort();
+  signal?.addEventListener("abort", abort, { once: true });
+  return {
+    signal: controller.signal,
+    dispose: () => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+    }
+  };
+}
+async function fetchAuthorized(operation, options = {}) {
+  if (operation.kind !== "outbound-http" || operation.method !== "GET" && operation.method !== "HEAD")
+    return failure("runtime.unsupported-method");
+  const target = canonicalizeOutboundTarget(operation.target);
+  if (target === null || target !== operation.target)
+    return failure("runtime.invalid-target");
+  const url = new URL(target);
+  const protocol = url.protocol === "https:" ? "https:" : "http:";
+  const port = protocol === "https:" ? 443 : 80;
+  const timeoutMs = options.operationTimeoutMs ?? RUNTIME_LIMITS.operationTimeoutMs;
+  const combined = combineSignals(
+    options.signal,
+    Math.max(1, Math.min(timeoutMs, RUNTIME_LIMITS.operationTimeoutMs))
+  );
+  try {
+    const resolver = options.resolver ?? defaultResolver;
+    const resolved = await resolver.lookup(url.hostname, combined.signal);
+    const addresses = validateResolvedAddresses(
+      resolved,
+      RUNTIME_LIMITS.maxDnsAddresses
+    );
+    if (addresses === null || addresses.length === 0)
+      return failure("runtime.address-denied");
+    const selected = addresses[0];
+    const transport = options.transport ?? defaultTransport;
+    let response;
+    try {
+      response = await transport.request({
+        protocol,
+        hostname: url.hostname,
+        address: selected.address,
+        port,
+        path: `${url.pathname}${url.search}`,
+        method: operation.method,
+        headers: { host: url.host, "accept-encoding": "identity" },
+        ...protocol === "https:" ? { servername: url.hostname } : {},
+        signal: combined.signal
+      });
+    } catch {
+      return combined.signal.aborted ? failure("runtime.timeout") : failure("runtime.internal");
+    }
+    if (combined.signal.aborted) return failure("runtime.timeout");
+    if (response.status >= 300 && response.status <= 399)
+      return failure("runtime.redirect-rejected");
+    if (responseHeaderBytes(response.headers) > RUNTIME_LIMITS.maxResponseHeaderBytes)
+      return failure("runtime.size-limit");
+    const encoding = headerValue(response.headers, "content-encoding");
+    if (encoding !== void 0 && encoding.toLowerCase() !== "identity")
+      return failure("runtime.size-limit");
+    const chunks = [];
+    let total = 0;
+    try {
+      for await (const chunk of response.body) {
+        if (combined.signal.aborted) return failure("runtime.timeout");
+        const bytes = chunk instanceof Uint8Array ? Uint8Array.from(chunk) : Uint8Array.from(chunk);
+        total += bytes.byteLength;
+        if (total > RUNTIME_LIMITS.maxResponseBodyBytes)
+          return failure("runtime.size-limit");
+        chunks.push(bytes);
+      }
+    } catch {
+      return combined.signal.aborted ? failure("runtime.timeout") : failure("runtime.internal");
+    }
+    const body = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+      body.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return {
+      ok: true,
+      value: { status: response.status, headers: response.headers, body }
+    };
+  } catch {
+    return combined.signal.aborted ? failure("runtime.timeout") : failure("runtime.dns-failed");
+  } finally {
+    combined.dispose();
+  }
+}
 function supportedContentType2(value) {
   if (value === void 0) return false;
   const mediaType = value.split(";", 1)[0]?.trim().toLowerCase() ?? "";
   return mediaType.startsWith("text/") || mediaType === "application/json" || mediaType === "application/javascript" || mediaType === "text/javascript" || mediaType === "text/css" || mediaType === "application/xml" || mediaType === "text/xml";
 }
+function responseHeader(headers, name) {
+  return headers.find(([key]) => key.toLowerCase() === name)?.[1];
+}
+function responseBodyReplacements(action) {
+  if ("replacements" in action && Array.isArray(action.replacements)) {
+    return action.replacements;
+  }
+  return [];
+}
+function isReplaceAction(action) {
+  return "mode" in action && action.mode === "replace";
+}
 async function rewriteResponseBody(input, replacements, replaceAction, captureContext) {
   if (!supportedContentType2(input.contentType) || input.contentType === void 0)
     return failure("runtime.size-limit");
@@ -22134,6 +22471,78 @@ async function rewriteResponseBody(input, replacements, replaceAction, captureCo
     }
   };
 }
+function replaceResponseBody(body, contentType, captureContext) {
+  const captures = captureContext === void 0 ? [] : matchUrlCaptures(captureContext.urlRegex, captureContext.url);
+  if (captureContext !== void 0 && captures === null) {
+    return failure("runtime.url-capture-mismatch");
+  }
+  const expanded = captureContext === void 0 ? body : substituteUrlCaptures(body, captures ?? []);
+  const encoded = new TextEncoder().encode(expanded);
+  if (encoded.byteLength > RUNTIME_LIMITS.maxResponseBodyBytes)
+    return failure("runtime.size-limit");
+  return {
+    ok: true,
+    value: {
+      body: encoded,
+      contentType: contentType?.split(";", 1)[0]?.trim() ?? "text/plain"
+    }
+  };
+}
+async function fetchAndRewriteAuthorizedResponse(operation, action, options = {}) {
+  if (operation.kind !== "outbound-http" || operation.method !== "GET")
+    return failure("runtime.unsupported-method");
+  const response = await fetchAuthorized(operation, options);
+  if (!response.ok) return response;
+  const contentType = responseHeader(response.value.headers, "content-type");
+  const transformed = isReplaceAction(action) ? replaceResponseBody(
+    action.body,
+    contentType,
+    operation.sourceValue === void 0 ? void 0 : { url: operation.target, urlRegex: operation.sourceValue }
+  ) : await rewriteResponseBody(
+    {
+      contentType,
+      contentEncoding: responseHeader(
+        response.value.headers,
+        "content-encoding"
+      ),
+      body: response.value.body
+    },
+    responseBodyReplacements(action)
+  );
+  if (!transformed.ok) return transformed;
+  return {
+    ok: true,
+    value: {
+      ...transformed.value,
+      status: response.value.status,
+      headers: response.value.headers
+    }
+  };
+}
+var RESPONSE_BODY_LISTENER_PREFIX = "/.rogatio/body/";
+function parseResponseBodyRedirect(rawUrl) {
+  const queryAt = rawUrl.indexOf("?");
+  const path2 = queryAt === -1 ? rawUrl : rawUrl.slice(0, queryAt);
+  const search = queryAt === -1 ? "" : rawUrl.slice(queryAt);
+  if (!path2.startsWith(RESPONSE_BODY_LISTENER_PREFIX)) return null;
+  const rest = path2.slice(RESPONSE_BODY_LISTENER_PREFIX.length);
+  const slash1 = rest.indexOf("/");
+  if (slash1 <= 0) return null;
+  const slash2 = rest.indexOf("/", slash1 + 1);
+  if (slash2 <= slash1 + 1) return null;
+  let ruleId;
+  let digest;
+  try {
+    ruleId = decodeURIComponent(rest.slice(0, slash1));
+    digest = decodeURIComponent(rest.slice(slash1 + 1, slash2));
+  } catch {
+    return null;
+  }
+  if (ruleId.length === 0 || digest.length === 0) return null;
+  const original = rest.slice(slash2 + 1) + search;
+  if (!/^https?:\/\//i.test(original)) return null;
+  return { ruleId, digest, originalUrl: original };
+}
 function originOf(value) {
   const direct = normalizeSiteOrigin(value);
   if (direct !== null) return direct;
@@ -22445,6 +22854,9 @@ function writeResponse(res, status, statusMessage, headers, body) {
   res.writeHead(status, statusMessage, out);
   res.end(body);
 }
+function asPresetDigest(value) {
+  return value.startsWith("sha256:") ? value : null;
+}
 function initiatorFromHeaders(headers, targetUrl) {
   const origin = headerValue2(headers, "origin");
   if (typeof origin === "string" && /^https?:\/\//i.test(origin)) {
@@ -22487,6 +22899,10 @@ async function startInterceptProxy(options = {}) {
   async function handleHttp(req, res) {
     try {
       const targetUrl = req.url ?? "";
+      if (targetUrl.startsWith("/.rogatio/body/")) {
+        await handleResponseBodyRedirect(req, res, targetUrl);
+        return;
+      }
       if (!/^https?:\/\//i.test(targetUrl)) {
         res.writeHead(400);
         res.end();
@@ -22602,6 +23018,96 @@ async function startInterceptProxy(options = {}) {
       }
     }
   }
+  async function handleResponseBodyRedirect(req, res, rawUrl) {
+    const method = (req.method ?? "GET").toUpperCase();
+    if (method !== "GET") {
+      res.writeHead(405);
+      res.end();
+      return;
+    }
+    const parsed = parseResponseBodyRedirect(rawUrl);
+    const active = policy;
+    if (parsed === null || active === null || active.presetDigest === void 0) {
+      res.writeHead(parsed === null ? 400 : 403);
+      res.end();
+      return;
+    }
+    const presetDigest = asPresetDigest(active.presetDigest);
+    if (presetDigest === null || parsed.digest !== presetDigest) {
+      res.writeHead(403);
+      res.end();
+      return;
+    }
+    const operation = active.operations.find(
+      (op) => op.kind === "response-body" && op.ruleId === parsed.ruleId
+    );
+    if (operation === void 0 || !sourceMatches(operation.matcher.source, parsed.originalUrl)) {
+      res.writeHead(404);
+      res.end();
+      return;
+    }
+    if (operation.matcher.method !== void 0 && operation.matcher.method !== "GET") {
+      res.writeHead(405);
+      res.end();
+      return;
+    }
+    const target = canonicalizeOutboundTarget(parsed.originalUrl);
+    if (target === null) {
+      res.writeHead(400);
+      res.end();
+      return;
+    }
+    const allowed = revalidateAuthority(active.project, active.operations, {
+      groupId: operation.groupId,
+      ruleId: operation.ruleId,
+      url: parsed.originalUrl,
+      target,
+      method: "GET",
+      initiator: initiatorFromHeaders(req.headers, parsed.originalUrl) ?? new URL(target).origin,
+      resourceType: operation.matcher.resourceTypes[0]
+    });
+    if (!allowed.allowed) {
+      res.writeHead(403);
+      res.end();
+      return;
+    }
+    const fetched = await fetchAndRewriteAuthorizedResponse(
+      {
+        groupId: operation.groupId,
+        ruleId: operation.ruleId,
+        operationId: operation.ruleId,
+        kind: "outbound-http",
+        target,
+        method: "GET",
+        sourceValue: operation.matcher.source.value,
+        presetDigest
+      },
+      operation.responseBody
+    );
+    if (!fetched.ok) {
+      res.writeHead(502);
+      res.end();
+      return;
+    }
+    const headers = {};
+    for (const [name, value] of fetched.value.headers) {
+      const lower = name.toLowerCase();
+      if (lower === "set-cookie" || lower === "cookie" || lower === "authorization" || lower === "proxy-authorization") {
+        continue;
+      }
+      const existing = headers[lower];
+      if (existing === void 0) headers[lower] = value;
+      else if (Array.isArray(existing)) existing.push(value);
+      else headers[lower] = [existing, value];
+    }
+    writeResponse(
+      res,
+      fetched.value.status,
+      fetched.value.status === 200 ? "OK" : "Upstream",
+      headers,
+      Buffer.from(fetched.value.body)
+    );
+  }
   function handleConnect(req, clientSocket, head) {
     const authority = req.url ?? "";
     const [host, portText] = authority.split(":");
@@ -22646,6 +23152,19 @@ async function startInterceptProxy(options = {}) {
     }
   };
 }
+function steerKey(origin) {
+  const port = origin.port !== void 0 ? `:${origin.port}` : "";
+  return `steer:${origin.scheme}://${origin.host}${port}`;
+}
+function pacRouteFromEntry(entry) {
+  const steer = decodePacSteer(entry);
+  if (steer !== null) return { steer };
+  if (entry.includes("://")) {
+    return isExactHttpUrl(entry) ? { url: entry } : null;
+  }
+  if (entry.length === 0) return null;
+  return { hostname: entry };
+}
 function pacCheck(route) {
   if (typeof route.url === "string" && isExactHttpUrl(route.url)) {
     return {
@@ -22653,6 +23172,12 @@ function pacCheck(route) {
       line: `url === ${JSON.stringify(route.url)}`
     };
   }
+  if (route.steer !== void 0) {
+    return {
+      key: steerKey(route.steer),
+      line: steerPredicate(route.steer)
+    };
+  }
   if (typeof route.hostname === "string" && route.hostname.length > 0 && !route.hostname.includes("://")) {
     return {
       key: `host:${route.hostname}`,
@@ -22661,6 +23186,17 @@ function pacCheck(route) {
   }
   return null;
 }
+function steerPredicate(origin) {
+  const hostCheck = `host === ${JSON.stringify(origin.host)}`;
+  const base = origin.port !== void 0 ? `${origin.scheme}://${origin.host}:${origin.port}` : `${origin.scheme}://${origin.host}`;
+  if (origin.port !== void 0) {
+    const withSlash = JSON.stringify(`${base}/`);
+    const exact = JSON.stringify(base);
+    const withQuery = JSON.stringify(`${base}?`);
+    return `${hostCheck} && (url.indexOf(${withSlash}) === 0 || url === ${exact} || url.indexOf(${withQuery}) === 0)`;
+  }
+  return `${hostCheck} && url.indexOf(${JSON.stringify(base)}) === 0`;
+}
 function isExactHttpUrl(value) {
   try {
     const url = new URL(value);
@@ -22782,6 +23318,7 @@ function unsupportedReasons(capabilities) {
 function createPlatformInterceptionProvider(adapter) {
   let state = "stopped";
   let active = false;
+  let pacInstalled = false;
   return {
     platform: adapter.platform,
     detect() {
@@ -22793,6 +23330,17 @@ function createPlatformInterceptionProvider(adapter) {
       };
     },
     async start(activation, pacRoutes) {
+      const decoded = pacRoutes.flatMap((entry) => {
+        const route = pacRouteFromEntry(entry);
+        return route === null ? [] : [route];
+      });
+      if (pacRoutes.length === 0) {
+        const endpoint2 = await adapter.startTlsProxy(activation);
+        active = true;
+        pacInstalled = false;
+        state = "running";
+        return endpoint2;
+      }
       const capabilities = adapter.detect();
       const reasons = unsupportedReasons(capabilities);
       if (!capabilities.supported || reasons.length > 0) {
@@ -22804,20 +23352,17 @@ function createPlatformInterceptionProvider(adapter) {
         throw new Error("runtime.platform-unsupported");
       }
       const endpoint = await adapter.startTlsProxy(activation);
-      const pac = generatePacScript(
-        pacRoutes.map(
-          (entry) => entry.includes("://") ? { url: entry } : { hostname: entry }
-        ),
-        endpoint
-      );
+      const pac = generatePacScript(decoded, endpoint);
       try {
         await adapter.installPac(pac);
         active = true;
+        pacInstalled = true;
         state = "running";
         return endpoint;
       } catch (error) {
         await adapter.stopTlsProxy();
         active = false;
+        pacInstalled = false;
         state = "stopped";
         throw error;
       }
@@ -22827,9 +23372,10 @@ function createPlatformInterceptionProvider(adapter) {
         state = state === "unsupported" ? "unsupported" : "stopped";
         return;
       }
-      await adapter.removePac();
+      if (pacInstalled) await adapter.removePac();
       await adapter.stopTlsProxy();
       active = false;
+      pacInstalled = false;
       state = "stopped";
     },
     status() {
@@ -23429,7 +23975,7 @@ function createNativeRuntimeController(options) {
     return aiConfigInForce;
   }
   async function bindInterception(current, sessionConfig) {
-    if (sessionConfig.pacRoutes.length === 0) {
+    if (sessionConfig.pacRoutes.length === 0 && sessionConfig.contentListener !== true) {
       return {
         activation: { ...current, pacRoutes: [] },
         session: null,
@@ -23638,7 +24184,8 @@ function createNativeRuntimeController(options) {
         preset = normalized.value;
         activePolicy = {
           project: schemaResult.data,
-          operations: compileResult.operations
+          operations: compileResult.operations,
+          presetDigest: preset.digest
         };
         const startResult = await this.start();
         if (startResult.state !== "running") {
@@ -23686,6 +24233,7 @@ function createNativeRuntimeController(options) {
           policyDigest: typeof meta.policyDigest === "string" ? meta.policyDigest : "",
           extensionId: typeof meta.extensionId === "string" ? meta.extensionId : "",
           pacRoutes: Array.isArray(meta.pacRoutes) ? meta.pacRoutes : [],
+          contentListener: meta.contentListener === true,
           targetPolicy: {
             public: meta.targetPolicy?.public === true || meta.targetPolicy?.publicAllowed === true,
             localOrigins: Array.isArray(meta.targetPolicy?.localOrigins) ? meta.targetPolicy.localOrigins : []
@@ -24539,7 +25087,11 @@ function createNativeHost(options) {
       }
       const policy = controller.getActivePolicy();
       interceptProxy = await startInterceptProxy({
-        policy: policy ? { project: policy.project, operations: policy.operations } : null
+        policy: policy ? {
+          project: policy.project,
+          operations: policy.operations,
+          presetDigest: policy.presetDigest
+        } : null
       });
       return interceptProxy.endpoint;
     },
@@ -24560,7 +25112,11 @@ function createNativeHost(options) {
       const endpoint = await platformProvider.start(activation, routes);
       const policy = controller.getActivePolicy();
       interceptProxy?.setPolicy(
-        policy ? { project: policy.project, operations: policy.operations } : null
+        policy ? {
+          project: policy.project,
+          operations: policy.operations,
+          presetDigest: policy.presetDigest
+        } : null
       );
       return endpoint;
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "6.4.1",
+  "version": "6.5.0",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",